2026 CVEs (page 192)
Page 192 of 681 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-77543 | Critical | 9.9 | 2026-08-26 | A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Access Application to e… |
CVE-2026-77542 | Critical | 9.1 | 2026-08-26 | A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UID Enterprise Agent to exec… |
CVE-2026-77541 | Critical | 9.1 | 2026-08-26 | A malicious actor with access to the network and high privileges could exploit an Improper Access Control vulnerability found in UniFi Network Application to e… |
CVE-2026-77540 | Critical | 9.1 | 2026-08-26 | A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi OS Server to execute a… |
CVE-2026-77539 | Critical | 9.1 | 2026-08-26 | A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi OS Server to execute a… |
CVE-2026-77538 | High | 8.2 | 2026-08-26 | A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Connect Application to escalate privileges w… |
CVE-2026-77537 | Critical | 10.0 | 2026-08-26 | A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Protect Application to execute a Command I… |
CVE-2026-77536 | Critical | 9.9 | 2026-08-26 | A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in certain devices running UniFi O… |
CVE-2026-77535 | Critical | 9.1 | 2026-08-26 | A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi Network Application to… |
CVE-2026-77534 | Critical | 9.9 | 2026-08-26 | A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in certain devices running UniFi O… |
CVE-2026-59683 | Critical | 9.8 | 2026-08-26 | The OpenRGB network protocol allows to write attacker controlled strings into arbitrary file system paths (extension of CVE-2026-59682). This allows either a f… |
CVE-2026-59682 | Critical | 9.1 | 2026-08-26 | Arbitrary file overwrite via SAVE_PROFILE message in OpenRGB. This issue affects OpenRGB through 1.0rc3. |
CVE-2026-2388 | Medium | 6.4 | 2026-08-26 | The Reviews and Rating – Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.10. This is d… |
CVE-2026-19042 | High | 8.8 | 2026-08-26 | A command injection vulnerability in TeamViewer Full Client and Host for Linux prior to version 15.81.5 allows a remote attacker to execute arbitrary commands… |
CVE-2026-18794 | High | 8.2 | 2026-08-26 | The OpenRGB network protocol allows attackers to cause memory exhaustion and out-of-bounds memory reads and writes by passing inconsistent data. |
CVE-2026-16444 | High | 7.5 | 2026-08-26 | Improper neutralization of path traversal sequences in TeamViewer Desktop Clients prior Version 15.81.5 allows an authenticated remote session participant to w… |
CVE-2026-80237 | High | 8.8 | 2026-08-26 | EFence developed by Thinking Software Technology has an Arbitrary File Upload vulnerability. Authenticated remote attackers can upload and execute web shell ba… |
CVE-2026-80236 | High | 8.2 | 2026-08-26 | Efence developed by Thinking Software Technology has a SQL Injection vulnerability. Unauthenticated remote attackers can access file upload functionality and r… |
CVE-2026-80235 | Critical | 9.8 | 2026-08-26 | EFence developed by Thinking Software Technology has an Arbitrary File Upload vulnerability. Unauthenticated remote attackers can upload and execute web shell… |
CVE-2026-80234 | Medium | 5.3 | 2026-08-26 | CAYIN CMS-WS and CMS-SE developed by CAYIN Technology have a Missing Authentication vulnerability. Unauthenticated remote attackers can obtain media file lists… |
CVE-2026-80233 | High | 7.2 | 2026-08-26 | CAYIN CMS-WS, CMS-SE, and SMP series products developed by CAYIN Technology have an Arbitrary File Upload vulnerability. Privileged remote attackers can upload… |
CVE-2026-77533 | Critical | 9.9 | 2026-08-26 | A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Protect Application to… |
CVE-2026-19538 | High | 7.5 | 2026-08-26 | The BLOCKED access control list items that are evaluated to deny access on the the proxy protocol port can be bypassed completely when connecting over TCP or T… |
CVE-2026-19401 | High | 7.5 | 2026-08-26 | Any remote client can crash a (debugging/non-release build type) NSD serve child by sending it a special crafted message with a specially tuned number of DNS C… |
CVE-2026-19197 | Medium | 6.3 | 2026-08-26 | A user with organization administrator permissions can delete dashboard snapshots belonging to other organizations on the same Grafana instance, and can recove… |
CVE-2026-18916 | High | 7.5 | 2026-08-26 | Any remote client can crash a NSD serve child, by throttling the TCP receive window after a TCP query. By continuously crashing the serve childs, the remote cl… |
CVE-2026-18664 | Critical | 9.1 | 2026-08-26 | When ranges are used for access control (i.e. of the form 1.2.3.4-1.2.3.25), because NSD wrongly compares the IP address with the range on little endian system… |
CVE-2026-9668 | Medium | 6.3 | 2026-08-26 | With legitimate user credentials in hand, attackers can construct malicious SQL statements to bypass authentication logic and execute arbitrary database querie… |
CVE-2026-78237 | High | 7.8 | 2026-08-26 | Insufficient input validation in ABR allows a low-privileged user to inject malicious entries into the sudoers file, resulting in persistent root access that r… |
CVE-2026-78236 | High | 8.8 | 2026-08-26 | An insecure PIN derivation mechanism in ABR allows a low-privileged user to escalate privileges to administrator by communicating over Cross-Process Communicat… |
CVE-2026-75977 | High | 8.8 | 2026-08-26 | The Mang Board WP plugin for WordPress is vulnerable to Missing Authorization via Authentication Cookie Forgery in all versions up to, and including, 2.3.7. Th… |
CVE-2026-6178 | Medium | 6.4 | 2026-08-26 | The Betheme theme for WordPress is vulnerable to Stored Cross-Site Scripting via the theme's 'icon_box_2' shortcode in all versions up to, and including, 28.4… |
CVE-2026-18884 | High | 7.5 | 2026-08-26 | The WooCommerce Lottery plugin for WordPress is vulnerable to Time-Based SQL Injection via 'orderby' and 'order' GET Parameters in all versions up to, and incl… |
CVE-2026-58108 | | 2026-08-26 | The personal access token removal query selects from PersonalAccessTokenDB but filters on columns of Session, with no join between them. SQLAlchemy resolves th… | |
CVE-2026-3002 | Medium | 6.4 | 2026-08-26 | The Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the multiple blocks in… |
CVE-2026-18431 | Critical | 9.8 | 2026-08-26 | The Avada theme for WordPress is vulnerable to Arbitrary File Write in all versions up to, and including, 7.16 when the Fusion Builder plugin is installed and… |
CVE-2026-18331 | High | 7.2 | 2026-08-26 | The Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting… |
CVE-2026-15366 | | 2026-08-26 | A control logic defect in a specific built-in webpage of Kids Mode allows users to view local gallery photos directly within the page | |
CVE-2026-15365 | | 2026-08-26 | A pop-up logic flaw in a certain feature of Kids Mode allows users to bypass password verification and use Quick Apps outside the app. | |
CVE-2026-79654 | Medium | 4.3 | 2026-08-26 | A flaw was found in Katello where the Content View History API does not properly enforce authorization when accessing a Content View specified by the user. An… |
CVE-2026-78146 | Medium | 6.5 | 2026-08-26 | The Simple Newsletter Plugin WordPress plugin before 4.3.3 does not verify that the requester is the subscriber named in a public request before rendering tha… |
CVE-2026-77790 | Medium | 5.5 | 2026-08-26 | The RegistrationMagic WordPress plugin before 6.0.9.4 does not sanitise and escape a parameter before using it in a SQL statement, which could allow high priv… |
CVE-2026-77789 | Medium | 4.3 | 2026-08-26 | The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.1 does not verify that a subscription belongs to the customer bound to the requesting cust… |
CVE-2026-77758 | Medium | 5.3 | 2026-08-26 | The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.1 does not properly verify that a customer portal session has completed its confirmation s… |
CVE-2026-77757 | Medium | 5.4 | 2026-08-26 | The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.3 does not sanitize a user-supplied image reference befor… |
CVE-2026-77754 | Medium | 5.3 | 2026-08-26 | The Kirki WordPress plugin before 6.0.14 does not perform a capability check on some endpoints of one of its public AJAX actions, allowing unauthenticated use… |
CVE-2026-77695 | Medium | 6.5 | 2026-08-26 | The Return Refund and Exchange For WooCommerce WordPress plugin before 4.6.4 does not correctly verify the ownership of guest orders in some of the AJAX action… |
CVE-2026-77694 | Medium | 5.3 | 2026-08-26 | The Eventin WordPress plugin before 4.1.19 does not properly restrict which changes a guest checkout token is allowed to authorise on an order, allowing unaut… |
CVE-2026-77693 | High | 8.7 | 2026-08-26 | The Order Tip for WooCommerce WordPress plugin before 1.6.0 does not check the capability of the user requesting a file deletion, nor does it restrict which pa… |
CVE-2026-75798 | Medium | 5.3 | 2026-08-26 | The AI Engine WordPress plugin before 3.7.2 does not perform an authorisation check on one of its administration-only features, relying instead on a token it… |
CVE-2026-75797 | High | 7.7 | 2026-08-26 | The AI Engine WordPress plugin before 3.7.2 does not confine a caller-supplied URL when mapping it to a local filesystem path before reading the file and forw… |
CVE-2026-74930 | Medium | 4.3 | 2026-08-26 | The Project Manager WordPress plugin before 4.0.7 does not check that the user whose activity is being requested is the one making the request in one of its R… |
CVE-2026-74929 | Medium | 5.4 | 2026-08-26 | The Project Manager WordPress plugin before 4.0.7 does not restrict several of its REST API routes to the projects a user belongs to, allowing any authenticat… |
CVE-2026-74928 | High | 7.5 | 2026-08-26 | The Project Manager WordPress plugin before 4.0.7 does not have any authorisation check on its import routes, allowing unauthenticated users to create WordPre… |
CVE-2026-74851 | High | 7.2 | 2026-08-26 | The Pods WordPress plugin before 3.3.9.1 does not correctly compare a display callback against its list of blocked functions, allowing users with the author r… |
CVE-2026-58097 | High | 7.8 | 2026-08-26 | mp_SetEnddisc() copied a user-supplied PSN endpoint value without length validation, allowing a buffer overflow via the ppp(8) command interface. A local user… |
CVE-2026-58096 | High | 8.8 | 2026-08-26 | LcpDecodeConfig() did not validate the length of received endpoint discriminator options against the minimum required by RFC 1717. Undersized options would tr… |
CVE-2026-58095 | High | 8.8 | 2026-08-26 | mp_Enddisc() used incorrect length calculations when formatting endpoint discriminator addresses for display, allowing a received endpoint option to overflow a… |
CVE-2026-58094 | High | 7.8 | 2026-08-26 | The FIOSSHMLPGCNF ioctl(2) operation configures the page size for a largepage shared memory object. This is intended to be used immediately after creating the… |
CVE-2026-58093 | High | 7.0 | 2026-08-26 | The TIOCSCTTY ioctl handler drops the tty lock in order to acquire the process tree lock. After reacquiring the tty lock, the handler did not revalidate the s… |
CVE-2026-19760 | High | 7.2 | 2026-08-26 | The WP Fastest Cache – WordPress Cache Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via HTTP Host Header in all versions up to, and… |
CVE-2026-19718 | High | 8.1 | 2026-08-26 | The BlogVault Backup & Staging WordPress plugin before 6.65, MalCare WordPress Security Plugin WordPress plugin before 6.65, The WP Remote WordPress Plugin Wo… |
CVE-2026-19226 | Medium | 6.8 | 2026-08-26 | The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not validate some widget settings before outputting them inside an HTML attribute, which… |
CVE-2026-19220 | Low | 3.7 | 2026-08-26 | The Forminator Forms WordPress plugin before 1.57.1 does not verify that site registration is enabled on the network before creating a site signup, allowing u… |
CVE-2026-19094 | Medium | 5.3 | 2026-08-26 | The Tutor LMS WordPress plugin before 4.0.6 does not validate values used to build a database query, and does not restrict which template file a request may l… |
CVE-2026-16986 | Medium | 5.3 | 2026-08-26 | The Booking Package WordPress plugin before 1.7.25 does not validate the payment amount server-side against the stored service price, deriving the expected cha… |
CVE-2026-16984 | Medium | 6.5 | 2026-08-26 | The Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates WordPress plugin before 3.7.1 does not include an authoriza… |
CVE-2026-15203 | | 2026-08-26 | Improper access control in debug and engineering interfaces in Danfoss iC7-Automation SP, iC7-Marine, and iC7-Hybrid GR3 allows attackers to gain read/write ac… | |
CVE-2026-14550 | Medium | 5.3 | 2026-08-26 | The WPCafe WordPress plugin before 3.0.18 does not perform an authorization check when creating a reservation through its REST API, verifying only a publicly… |
CVE-2026-14216 | Medium | 6.5 | 2026-08-26 | The Booking for Appointments and Events Calendar WordPress plugin before 2.4.7 does not require authentication before processing its pending notification queu… |
CVE-2026-14212 | Medium | 4.7 | 2026-08-26 | The Booking for Appointments and Events Calendar WordPress plugin before 9.8 does not verify that an authenticated employee (provider) owns the provider accou… |
CVE-2026-13406 | Medium | 5.3 | 2026-08-26 | The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not perform any capability or nonce check before returning taxonomy term data for an arbi… |
CVE-2026-13404 | Medium | 5.3 | 2026-08-26 | The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not perform any capability or ownership check (relying only on a publicly-scrapeable nonc… |
CVE-2026-13172 | Medium | 5.3 | 2026-08-26 | The Eventin WordPress plugin before 4.1.22 does not restrict access to non-published content by status or ownership in one of its REST API namespaces, allowin… |
CVE-2026-9805 | Low | 2.7 | 2026-08-26 | SMM IHISI command handler, FMTSWriteUseIntelLib, for FMTS command 0x32, read and write data without checking buffer size and could cause buffer overflow. |
CVE-2026-80214 | | 2026-08-26 | LibreNMS’s Virtualization Discovery module is vulnerable to command line injection. An authenticated admin user can execute arbitrary code on the host server. | |
CVE-2026-80202 | High | 8.8 | 2026-08-26 | Kimai before 2.56.0 does not enforce team-membership checks in TimesheetVoter::voteOnAttribute(), which maps permissions only to own_timesheet or other_timeshe… |
CVE-2026-80201 | Low | 2.0 | 2026-08-26 | Kimai before 2.53.0 fails to block sensitive User methods in the Twig invoice template sandbox, allowing admins to call getApiToken() and getPlainApiToken() me… |
CVE-2026-80200 | Medium | 4.7 | 2026-08-26 | Kimai before 2.53.0 contains an open redirect vulnerability in the SAML authentication success handler that accepts unvalidated RelayState POST parameters as r… |
CVE-2026-80199 | Low | 3.7 | 2026-08-26 | Kimai before 2.54.0 contains a timing oracle vulnerability in TokenAuthenticator that allows unauthenticated attackers to enumerate valid usernames via X-AUTH-… |
CVE-2026-80198 | High | 7.5 | 2026-08-26 | Kimai versions before 2.56.0 fail to restrict the config() Twig function in sandboxed invoice and export templates, allowing administrators to access arbitrary… |
CVE-2026-80197 | Medium | 4.3 | 2026-08-26 | Kimai before 2.57.0 contains an improper authorization vulnerability in the favorite timesheet add and remove endpoints that allows authenticated users to mani… |
CVE-2026-80196 | High | 7.5 | 2026-08-26 | Kimai before 2.58.0 contains an authentication bypass vulnerability where password reset links remain valid after password changes because the LoginLink signat… |
CVE-2026-80195 | Medium | 5.4 | 2026-08-26 | Kimai before 2.63.0 contains a business logic / improper authorization vulnerability in the team update API endpoint (PATCH /api/teams/{id}), which removes all… |
CVE-2026-80194 | Medium | 4.3 | 2026-08-26 | Kimai before 2.64.0 contains a missing authorization vulnerability in the ProjectViewController export route (report_project_view_export). The authorization gu… |
CVE-2026-80193 | High | 8.8 | 2026-08-26 | Kimai before 2.62.0 fails to validate create_other_timesheet permission in the QuickEntry controller when creating new timesheets. Authenticated users with vie… |
CVE-2026-80192 | High | 8.1 | 2026-08-26 | @better-auth/sso before 1.6.27 (and before 1.4.8 in the 1.4.x line and before 1.7.0-rc.5 in the 1.7 prerelease line) contains two domain-ownership flaws. When… |
CVE-2026-80191 | High | 7.5 | 2026-08-26 | GROWI applies its page-viewer permission check to attachment requests only when the request carries an authenticated user. retrieveAttachmentFromIdParam in app… |
CVE-2026-80189 | Medium | 6.5 | 2026-08-26 | LeafWiki extracts an uploaded ZIP archive without limiting how much data it will write. ZipExtractor.ExtractToDir in internal/importer/zip_extractor.go opens e… |
CVE-2026-76149 | Medium | 4.4 | 2026-08-26 | CorvusSKK contains an integer overflow vulnerability, which may allow malicious data to be written to a dictionary file. |
CVE-2026-76148 | High | 7.8 | 2026-08-26 | CorvusSKK contains a code injection vulnerability, which may lead to arbitrary code execution on the affected product. |
CVE-2026-73335 | Medium | 5.3 | 2026-08-26 | Android application "Myna Point" is vulnerable to Improper Authorization in Handler for Custom URL Scheme (CWE-939). A malicious application installed on the u… |
CVE-2026-58092 | High | 8.1 | 2026-08-26 | In FreeBSD 15.0, the kernel structure used to represent user credentials changed: previously the primary group ID was stored in the first element of the array… |
CVE-2026-58091 | High | 7.8 | 2026-08-26 | The implementation of this ioctl attempts to acquire locks on all channels in a sync group. If locking a channel would block, it releases the sync group list… |
CVE-2026-58090 | High | 7.8 | 2026-08-26 | The SOCK_STREAM receive path in the unix socket implementation failed to fully detach control messages from the socket buffer before processing them. Some err… |
CVE-2026-58089 | High | 7.8 | 2026-08-26 | When a process calls execve(2) to execute a setuid or setgid image, hwpmc(4) is supposed to detach PMCs owned by unprivileged processes. An inverted check mea… |
CVE-2026-57171 | High | 7.7 | 2026-08-26 | Compliance-trestle (Trestle) is a Python SDK and command-line tool for managing OSCAL compliance documents. In versions before 3.12.4 and versions 4.0.0 throug… |
CVE-2026-57170 | High | 7.8 | 2026-08-26 | Compliance-trestle (Trestle) is a Python SDK and command-line tool for managing OSCAL compliance documents. In versions prior to 3.12.4 and 4.0.0 through 4.0.3… |
CVE-2026-54467 | High | 7.0 | 2026-08-26 | On the Trusted Firmware-M (TF-M) 2 through 2.3.0 platform before 00d1b3e, mailbox initialization on PSOC64 and RP2350 accepts a non-secure, unvalidated, suppli… |
CVE-2026-52776 | | 2026-08-26 | Compliance-trestle (Trestle) is a tooling platform for managing compliance as code. In versions before 3.12.4 and versions 4.0.0 through 4.0.3, the URLSecurity… |